Create Release Tag #22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Create Release Tag | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| bump: | |
| description: Release bump type | |
| required: true | |
| default: patch | |
| type: choice | |
| options: | |
| - patch | |
| - minor | |
| - major | |
| permissions: | |
| contents: read | |
| jobs: | |
| create-release-tag: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Reject disabled major releases | |
| if: ${{ inputs.bump == 'major' }} | |
| run: | | |
| echo "::error::Major releases are not enabled yet. Choose patch or minor." | |
| exit 1 | |
| - name: Validate release tag token | |
| env: | |
| RELEASE_TAG_TOKEN: ${{ secrets.RELEASE_TAG_TOKEN }} | |
| run: | | |
| if [ -z "$RELEASE_TAG_TOKEN" ]; then | |
| echo "::error::RELEASE_TAG_TOKEN is required so pushed tags trigger the release workflow. Configure a fine-grained PAT with Contents: Read and write for this repository." | |
| exit 1 | |
| fi | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: main | |
| fetch-depth: 0 | |
| token: ${{ secrets.RELEASE_TAG_TOKEN }} | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.26' | |
| - name: Run tests | |
| run: make test | |
| - name: Run binary smoke test | |
| run: make smoke | |
| - name: Compute next tag | |
| id: next-tag | |
| run: | | |
| set -euo pipefail | |
| git fetch --force --tags origin | |
| semver_pattern='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$' | |
| latest_tag=$(git tag --list 'v[0-9]*.[0-9]*.[0-9]*' | grep -E "$semver_pattern" | sort -V | tail -n 1 || true) | |
| if [ -z "$latest_tag" ]; then | |
| latest_tag="v0.0.0" | |
| fi | |
| version="${latest_tag#v}" | |
| IFS=. read -r major minor patch <<< "$version" | |
| case "${{ inputs.bump }}" in | |
| patch) | |
| patch=$((patch + 1)) | |
| ;; | |
| minor) | |
| minor=$((minor + 1)) | |
| patch=0 | |
| ;; | |
| *) | |
| echo "::error::Unsupported bump type: ${{ inputs.bump }}" | |
| exit 1 | |
| ;; | |
| esac | |
| next_tag="v${major}.${minor}.${patch}" | |
| if ! echo "$next_tag" | grep -Eq "$semver_pattern"; then | |
| echo "::error::Computed tag ${next_tag} is not a strict semver tag." | |
| exit 1 | |
| fi | |
| if git rev-parse --verify --quiet "refs/tags/${next_tag}" >/dev/null; then | |
| echo "::error::Tag ${next_tag} already exists locally." | |
| exit 1 | |
| fi | |
| if git ls-remote --exit-code --tags origin "refs/tags/${next_tag}" >/dev/null 2>&1; then | |
| echo "::error::Tag ${next_tag} already exists on origin." | |
| exit 1 | |
| fi | |
| echo "tag=${next_tag}" >> "$GITHUB_OUTPUT" | |
| echo "Computed next release tag: ${next_tag}" | |
| - name: Create and push tag | |
| env: | |
| TAG_NAME: ${{ steps.next-tag.outputs.tag }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git tag -a "$TAG_NAME" -m "Release $TAG_NAME" | |
| git push origin "$TAG_NAME" | |
| - name: Write summary | |
| env: | |
| TAG_NAME: ${{ steps.next-tag.outputs.tag }} | |
| run: | | |
| { | |
| echo "## Release tag created" | |
| echo | |
| echo "- Tag: \`${TAG_NAME}\`" | |
| echo "- Bump: \`${{ inputs.bump }}\`" | |
| echo | |
| echo "The existing tag-triggered release workflow will publish the prerelease from this pushed tag. Tags are pushed with \`RELEASE_TAG_TOKEN\` so the release workflow is eligible to run." | |
| } >> "$GITHUB_STEP_SUMMARY" |